Analysis
- max time kernel
132s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/06/2024, 11:09
General
- Target f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe
- Size 3.5MB
- Sample240602-m9klhsbc5s
- SHA256 f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b
Malware Config
Extracted
-
lumma
-
https://valuablestraigwhi.shop/api
-
https://horsedwollfedrwos.shop/api
-
https://patternapplauderw.shop/api
-
https://understanndtytonyguw.shop/api
-
https://considerrycurrentyws.shop/api
-
https://messtimetabledkolvk.shop/api
-
https://detailbaconroollyws.shop/api
-
https://deprivedrinkyfaiir.shop/api
-
https://relaxtionflouwerwi.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe"C:\Users\Admin\AppData\Local\Temp\f63ac140ab4aabfdb9da63f45f22e696ba17186e09aafb14a9ef9137a48bfe4b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4160,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3224-69-0x0000000000400000-0x0000000000456000-memory.dmp
memory/3224-73-0x0000000000400000-0x0000000000456000-memory.dmp
memory/3224-67-0x0000000000400000-0x0000000000456000-memory.dmp
memory/4188-32-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-28-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-5-0x0000000005260000-0x000000000533E000-memory.dmp
memory/4188-6-0x0000000004F50000-0x0000000004F6C000-memory.dmp
memory/4188-66-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-60-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-58-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-3-0x0000000005140000-0x000000000525A000-memory.dmp
memory/4188-71-0x0000000074580000-0x0000000074D30000-memory.dmp
memory/4188-2-0x0000000005080000-0x000000000511C000-memory.dmp
memory/4188-56-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-53-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-50-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-48-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-46-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-44-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-42-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-36-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-34-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-0-0x000000007458E000-0x000000007458F000-memory.dmp
memory/4188-4-0x0000000074580000-0x0000000074D30000-memory.dmp
memory/4188-26-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-30-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-24-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-22-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-20-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-19-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-12-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-10-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-8-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-64-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-62-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-54-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-40-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-39-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-16-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-14-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-1-0x00000000002B0000-0x000000000062E000-memory.dmp
memory/4188-72-0x0000000074580000-0x0000000074D30000-memory.dmp
memory/4188-7-0x0000000004F50000-0x0000000004F65000-memory.dmp
memory/4188-74-0x0000000074580000-0x0000000074D30000-memory.dmp